[MEDIUM] TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

PKSA-rtck-8z1q-gn5s CVE-2026-0859 GHSA-7vp9-x248-9vr9

Affected package: typo3/cms-core

Affected version: >=10.0.0,<=10.4.54|>=11.0.0,<=11.5.48|>=12.0.0,<=12.4.40|>=13.0.0,<=13.4.22|>=14.0.0,<=14.0.1

Reported by:
GitHub